LAST UPDATED March 20, 2023
Read this document to learn how we use data for publishers and content creators. In this policy “we”, “us”, etc. refers to Brave Software Inc.
If you are a creator who has a YouTube or Twitch account, or owns a website, Brave has a function that allows you to automatically receive gifts of BAT from Brave itself, and from your visitors. Brave tallies BAT donations to each website and channel (i.e. YouTube channel, Twitch channel, etc.) anonymously.
Contributions to creators that have not signed up with Brave will be reserved on the device. No data about these creators or the attention spent on their sites will be transmitted to us at Brave. The data and all of the logic surrounding it will be entirely “client-side” (i.e. on the device only).
To collect Basic Attention Tokens (BAT) you must create a Brave Rewards account on this site. This involves entering your name, email address, and phone number. It is also necessary to demonstrate that you are the owner of the site(s) or channel(s) for which you receive BAT. This is done by providing information from your web server or DNS provider. We may authenticate your credentials with the site that hosts your channel. In addition to authenticating your credentials with the site that hosts your channel, we will also check your email address at https://haveibeenpwned.com/ to determine if it has been compromised to help protect against fraud. We rely on legitimate interests to conduct this check.
Before you can redeem BAT you will have to connect your Brave Rewards account to Uphold or Gemini, a payments service. Uphold or Gemini, based on your selection, will then tell us whether your account is in good standing, the list of currencies you have configured, and your preferred currency.
We record IP addresses when requests are made to identify & prevent fraud and to protect the integrity of the service. We also monitor how the account is used, for anti fraud and to maintain the reliability and performance of the service.
If you ask us to keep in touch with you by email, we will use SendGrid or MailChimp based in the United States to help us contact you. The processing of personal data on our behalf is subject to a range of measures to help safeguard your personal data including the use of EU standard contractual clauses. Every email we send this way will also include an unsubscribe link.
Publishers and content creators
|Purpose of processing||Categories of personal data processed||Legal basis of processing||Duration of storage|
|To communicate with publishers and creators that have signed up as Brave business partners.||Name, e-mail address, frequency of access to these emails, links clicked, and phone number (if provided).||Necessary for the performance of the contract agreed between both the creator and Brave (and necessary for us to provide the requested service).||The duration of the creator’s account with Brave.|
|To maintain accounts, statistics, and billing with publishers and creators that have signed up as Brave business partners.||Name, e-mail address, Uphold wallet ID, phone number, names and URIs1 of websites, Youtube, Twitch etc., including their favicons or avatars, an internal publisher ID, and transaction details.||Necessary for the performance of the contract agreed between both the creator and Brave (and necessary for us to provide the requested service).||The duration of the creator’s account with Brave.|
|To enable all publishers and creators to accumulate contributions of BAT from Brave, and from Brave users.||Names and URIs1 of websites, Youtube, Twitch etc., and publicly available contacts, and transaction details.||Our interest in providing publishers and content creators with BAT as soon as they start to work with Brave. The data are used in a way that does not negatively affect your rights or interests.||Indefinite.|
|To comply with tax obligations.||Uphold wallet ID (plus Brave revenue from transactions, which are not personal data), and transaction details.||Necessary for compliance with a legal obligation.||4 years after end of creator’s account.|
|Internal communications.||Name, e-mail address, and internal publisher ID at the time of communication.||Necessary for the performance of the contract agreed between both the creator and Brave (and necessary for us to provide the requested service).||Indefinite.|
|To detect fraudulent claims of “referral rewards”, ads and “user growth pool” BAT grants.||Name, e-mail, phone number, IP address, names and addresses of channels (websites, Youtube, Twitch URI1 etc.) including their favicons or avatars, an internal publisher ID, internal identifiers. Where PayPal is used, the PayPal user’s country, verification status, and PayPal account ID.||Necessary for the performance of the contract agreed between both the creator and Brave (and necessary for us to provide the requested service). The duration of the creator’s account with Brave. (Data may be stored indefinitely in the case of detected fraudsters).|
We are represented in Europe by Brave Software Europe Ltd (based in the UK). You can contact our data protection officer and the rest of our privacy team at firstname.lastname@example.org. However, from the 1st January 2021, given the UK’s exit from the EU, Brave has appointed an EU nominated representative and which you may contact if you would prefer not to contact Brave directly:
Brave EU Nominated Representative
Care of Castlebridge
Unit 7, 12 Mountjoy Square,
You can ask to know what information we have about you, update incorrect information, delete it, object to our use of it, or get a copy of it. If you’re in the European Union, you also have the right to complain to your local data protection authority (though everyone should have this right).
We’ll update this policy whenever we make material changes to our practices, and we’ll announce it to let you know.
For an explanation of what a URI is see https://en.wikipedia.org/wiki/Uniform_Resource_Identifier. If some of the names of these websites and channels that Brave has recorded to facilitate BAT gifts from Brave and donations from users happen to contain people’s names, then we treat these URLs as personal data. ↩︎